iDEFENSE Security Advisory 2011-06-14.1

iDefense Security Advisory 06.14.11 – Remote exploitation of a integer signedness vulnerability in Adobe Systems Inc.’s Shockwave could allow an attacker to execute arbitrary code with the privileges of the current user. This vulnerability occurs when Shockwave processes a maliciously constructed « Lscr » record. This record can embed Lingo script code, which is Shockwave’s scripting language. The vulnerability occurs when processing certain opcodes. Specifically, a 32-bit value from the file is used as an offset into a heap buffer without proper validation. When comparing the value to the maximum buffer size, a signed comparison is performed. By using a negative value, it is possible to index outside of the allocated buffer. This results in data outside of the buffer being treated as a valid pointer, and this pointer is later used as the destination of a write operation. This can corrupt an arbitrary memory address, which can lead to the execution of arbitrary code. Shockwave Player version 11.5.9.620 and prior are vulnerable.

Source: iDEFENSE Security Advisory 2011-06-14.1